Watch the video, transcript and sources
- Binance: about $6.3B (Binance), $6.36B (TRM), $6.43B (Elliptic); 50 pre-signed authorizations on Ethereum per Elliptic; no government has confirmed attribution
- Claude Code 2.1.313 in Cursor's marketplace: about 11 hours, at most 5,000 installs, not written by Anthropic; entry path not stated
- Northflank: Wiz alert 11:43 UTC, assume all environment variables decrypted at 13:58 UTC, users report AI keys used; no post-mortem yet
+ Mistral Large 4 weights: about 1T parameters, modified MIT license; a Model as a Service business needs a separate license; benchmarks are Mistral's own chartCrypto security is supposed to mean guarding the private keys. In Binance's case, Elliptic says the attacker got Binance's own systems to sign billions of dollars of withdrawals. There is also one clause in one of these stories that decides who may host a trillion parameter model. I will save it for the end. A hot wallet is the crypto wallet an exchange keeps online so withdrawals go out instantly. Think of the cash drawer at a bank, except the drawer is connected to the internet.
Story one. On Thursday evening, Binance wallets on ten blockchains started sending their balances to addresses controlled by one attacker. TRM Labs says most of it left in about twenty minutes, beginning at five past eight UTC. The total depends on who counts. Binance estimates about six point three billion dollars. TRM counts six point three six, and Elliptic counts six point four three. Either way it is the largest crypto theft on record, roughly four times the Bybit hack from twenty twenty five. Elliptic describes the mechanism. On Ethereum, one transaction carried fifty authorizations, each signed with that hot wallet's key and each with a different transaction counter, so one was sure to match. A feature from the twenty twenty five Pectra upgrade then handed the wallet to the attacker's contract, which emptied it three and a half minutes later.
How did the attacker get Binance to sign? Binance's first statement said a DevOps engineer's laptop may have been compromised, giving access to a service container that could submit unauthorized withdrawals. A later update says there were additional points of breach and does not name them. Bybit's way in was also a developer's machine, Elliptic notes. Binance says user funds are safe, deposits are unaffected, and it will cover all losses. Withdrawals are paused and expected back within a day or two. Elliptic counts forty four percent frozen. TRM attributes the theft to North Korea's TraderTraitor group with high confidence, Elliptic says likely, and no government has confirmed it. The lesson sits in the machines around the keys. I would audit what can ask your signing system for a transaction. Story two. On Thursday, for about eleven hours, the Cursor extension marketplace served a modified build of Anthropic's Claude Code extension, version two point one point three one three. Cursor says Anthropic did not write it, and that at most five thousand people installed it.
The injected code sits in front of the extension's normal code, so it runs the moment the editor loads the file, with no click. Cursor says it collects the hostname, username and environment variable names, tries to add an attacker's SSH key, and tries to open a reverse tunnel that retries every minute. The odd detail is a bug, found by the security firm Phorion. On a Mac, the script checks whether remote login is off with a command that, without admin rights, prints an error and still reports success. The script never sees the word off, so it assumes remote login is on and skips turning it on. Cursor says the login step fails on most machines, though the key, the persistence and the report still happen. If you updated on Thursday, search your SSH authorized keys file for the comment S V C telemetry. Cursor says uninstalling the extension may not be enough, because the payload drops its own scripts, so use its removal scripts and rotate credentials from a trusted machine. Cursor shut down and rebuilt its marketplace, and the attacker's server is offline. Its notice does not say how the modified build got in.
Story three. Northflank runs services, databases and builds for developers. Its status page lists a security incident, and the timeline begins at eleven forty three UTC on Friday, with an alert from the security company Wiz. Nineteen minutes later came the first network patch. By one forty customers were told to rotate environment variables immediately. Eighteen minutes after that the message changed to assume every environment variable has been decrypted, and disable or rotate all keys. Then the line that touches your bill. The page says multiple users are confirming that their AI keys have been used. By three twelve, Northflank had switched on secret rotation for Postgres and MongoDB add-ons for all users, and it recommends turning off public exposure on those add-ons if you enabled it.
Networking, builds and add-ons are listed as in major outage, and there is no post-mortem yet, so how the attacker got in is not public. Rotate every secret on workloads, secret groups and global secrets, starting with keys that bill per use, like AI provider keys. Then check each provider's usage page for calls you did not make. Story four. On October sixth I told you Mistral Large 4 was in preview and the weights were promised for the end of October. On Thursday the weights landed, with two days to spare. Mistral nicknames it Le Chonk, which suits a model with a trillion parameters. Hacker News gave the announcement over sixteen hundred points.
It is a mixture of experts. Of its one trillion parameters, about fifty billion are active for each token, using four of a hundred and twenty eight experts. Mistral says it trained the model on thirty eight hundred Nvidia Blackwell chips in its own European data centers. The benchmark chart is Mistral's. It says Large 4 leads Cognition's private FrontierCode test at nineteen point seven percent, and scores forty one percent on Terminal Bench four. On the Artificial Analysis coding index it ties the best open model while using forty seven percent fewer tokens. Only Claude Opus 5.5 beat it in a blind human preference test, Mistral says. Now the clause I saved. The license is a modified MIT, free for commercial and non-commercial use. But a business that gives third parties access to the model through an API or hosted endpoints needs a separate commercial license from Mistral. Using it inside your own company is exempt.
Verdict: NEEDS REVIEW — Four stories, four open questions. Read the primary sources.
Sources
https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
https://www.elliptic.co/insights/binance-largest-hack-in-history/
https://www.wired.com/story/the-dollar63-billion-binance-hack-was-pulled-off-in-just-20-minutes/
https://www.npr.org/2026/10/30/g-s1-150902/blockchain-intelligence-firms-link-north-korea-to-6-3b-hack-on-binance
https://news.ycombinator.com/item?id=50305480
https://news.ycombinator.com/item?id=50304607
https://cursor.com/blog/claude-code-extension-security-notice
https://news.ycombinator.com/item?id=50301004
https://phorion.io/blog/offical-claude-code-vsx-compromise/
https://news.ycombinator.com/item?id=50300683
https://status.northflank.com/cmvv0rn5a092f14rutwccodpp
https://status.northflank.com
https://news.ycombinator.com/item?id=50305025
https://mistral.ai/news/mistral-large-4-oss/
https://news.ycombinator.com/item?id=50289418
https://huggingface.co/mistralai/Mistral-Large-4-1T-A52B
https://huggingface.co/mistralai/Mistral-Large-4-1T-A52B/blob/main/LICENSE
https://www.youtube.com/watch?v=AedWnIqLX50
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.